[Barnes & Noble Nook Tablet] hkvc:
baby step2 of linboothkvc

Hi Loglud/All,

Thanks for your inputs.

Not sure about ur (Loglud) 1:1 map part comment. Currenty when people say 1:1 I am not sure whether they mean linear map (i.e with a constant addition or substration you can get virtual - to - physical mapping and inturn the other way round) or same to same mapping, I have to look at arm initial booting code and see what they mean (and in turn what ARM requires), because they require this when booting and inturn the mmu gets enabled.

Also the code to dump the map what I put above, was my first attempt at kernel level view of memory maps after ages, so there are some FUNNY ;-) errors in the way I tried to dump it quick and dirty.

If you are talking about 0xC000.0000 (Virt) to 0x8000.0000 (Phys) mapping which I mentioned, I still feel it is linear mapping, but I have to verify once. Linux kernel used to maintain a linear mapped region to simplify the internal management of physical pages(i.e memory), so that they can convert from virt2phy and back easily wrt physical memory with out requiring to go thro pagetables and for other reasons (Obviously with limits, i.e the Full memory is not linearly mapped but the initial 800MB or 900MB or so used to be). I will verify it later.

Either way independent of that I have potentially found the region which I will be attacking wrt getting the required same-to-same mapping (which I want to use, even if linear map is good enough, which again I am not sure is true at this time). The VIRTUAL ADDRESS space set aside for kernel Modules in Linux (MODULES_VADDR (0xbf00.0000 ...) and MODULES_END) overlaps with the actual physical memory location (0x8000.0000 - 0xc000.0000) here. And there is enough free memory in this module virtual address space, as there are only 2 modules loaded in NookTab, plus the region is originally there to allow lot of modules plus worst case I don't really worry much about stomping_on/reusing someone elses used memory because I am going to kill the system shortly and I have already locked the current cpu by blocking interrupts.

Inturn I will initially see if there is a physical page in the physical address space from 0xbf00.0000 to MODULES_END such that I can do a direct same-to-same mapping into the corresponding Virtual address space. Again even if there is non, at one level I may not have to mind really ;-) as I will be nuking the full system shortly.

I am looking at same-to-same mapping to allow the code which will do the mmu disable to continue to work before and after mmu disabling. While a Linear mapped region is good to load the code (bootloader, kernel, ....), before mmu is switched off, which will be passed control after mmu has been disabled, and which inturn can welcome the new system.

NOTE: I am in this more for the fun of exploring, so at least initially I don't want to use kexec and modify it (If I fail, then I may look at using it directly, but don't see a reason to fail for now), rather I want to come up with a concept (and as you rightly mentioned, even kexec follows (and it definitely should) similar concept to a great extent except for may be some of the implementation steps, as end goals are similar) and then implement it for the fun of it, even in crazy ways if possible (I am just starting out on this now, so I dont want to say one way or the other on this aspect now) just for it :-)

NOTE: I am explaining my thoughts, so if someone else is interested in experimenting parallely on his/her own, they can get some ideas (good or bad :-)